Disclaimer...this is "to the best of my understanding"
If you want the firewall & content filtering features of the MX60W in front of your wifi, then I'd plug the WAN port of the MX60W into the LAN of your network. So long as the MX60W unit can get to the internet, you'll be able to configure the wireless settings of the MX60W unit.
A possibly better solution would be to simply use the MR access points which have firewall, traffic shaping, access control and more functions built-in. They also allow multiple SSID's on multiple vlans so you can allow some users onto the "business" and others into a "guest." Unless you really need a specific feature of the MX-line to apply only to your wireless units, then the MR is a better bet. The MR is also a much better wireless AP anyways.